Judge has assessed an item in Issue #270 as Medium risk. The relevant finding follows:
6.L- Admin config ProtocolFee and gasFee missing max amount check which can be used to take fund from user
With PROTOCOL_FEE_BPS > 10000 (more than 100%), the exchange can steal user WETH who might approve max WETH allowance for InfinityExchange.sol
To provide safety for user and in case of compromised both admin and MATCH_EXECUTOR bot server.
Protocol should prevent potential further damage that might steal WETH from all user approve Exchange before.
With maximum amount of WETH_TRANSFER_GAS_UNITS is 4_294_967_296 and default value is 50_000, basically exchange can take any amount of WETH from user if gas price set high enough.
function updateWethTranferGas(uint32 _wethTransferGasUnits) external onlyOwner {
require(_wethTransferGasUnits <= 200_000); // for deflation token or voting token transfer cannot really be more than 200000 gas per transaction
WETH_TRANSFER_GAS_UNITS = _wethTransferGasUnits;
emit NewWethTransferGasUnits(_wethTransferGasUnits);
}
Judge has assessed an item in Issue #270 as Medium risk. The relevant finding follows:
6.L- Admin config
ProtocolFee
andgasFee
missing max amount check which can be used to take fund from userWith
PROTOCOL_FEE_BPS > 10000
(more than 100%), the exchange can steal user WETH who might approve max WETH allowance forInfinityExchange.sol
To provide safety for user and in case of compromised both admin andMATCH_EXECUTOR
bot server. Protocol should prevent potential further damage that might steal WETH from all user approve Exchange before.With maximum amount of
WETH_TRANSFER_GAS_UNITS
is4_294_967_296
and default value is50_000
, basically exchange can take any amount of WETH from user if gas price set high enough.